A Life-long Learning Intrusion Detection System for 6G-Enabled IoV

TL;DR

The paper addresses the need for adaptive intrusion detection in 6G-enabled IoV environments where attack patterns evolve rapidly. It proposes a life-long learning IDS that combines class-incremental learning with federated learning, guided by the CLEAR framework and coordinated by MEC servers, and evaluates on the 5G-NIDD dataset to demonstrate robust learning of new threats while retaining prior knowledge. The main contributions are the first integration of class-incremental learning with federated learning for cyberattack detection in IoV, coupled with a MEC-centric training architecture and CLEAR-based replay to mitigate forgetting. The results show high accuracy and low false positives in both centralized and federated settings, with strong scalability across increasing numbers of clients, indicating practical applicability for distributed IoV security in a 6G context.

Abstract

The introduction of 6G technology into the Internet of Vehicles (IoV) promises to revolutionize connectivity with ultra-high data rates and seamless network coverage. However, this technological leap also brings significant challenges, particularly for the dynamic and diverse IoV landscape, which must meet the rigorous reliability and security requirements of 6G networks. Furthermore, integrating 6G will likely increase the IoV's susceptibility to a spectrum of emerging cyber threats. Therefore, it is crucial for security mechanisms to dynamically adapt and learn new attack patterns, keeping pace with the rapid evolution and diversification of these threats - a capability currently lacking in existing systems. This paper presents a novel intrusion detection system leveraging the paradigm of life-long (or continual) learning. Our methodology combines class-incremental learning with federated learning, an approach ideally suited to the distributed nature of the IoV. This strategy effectively harnesses the collective intelligence of Connected and Automated Vehicles (CAVs) and edge computing capabilities to train the detection system. To the best of our knowledge, this study is the first to synergize class-incremental learning with federated learning specifically for cyber attack detection. Through comprehensive experiments on a recent network traffic dataset, our system has exhibited a robust adaptability in learning new cyber attack patterns, while effectively retaining knowledge of previously encountered ones. Additionally, it has proven to maintain high accuracy and a low false positive rate.

Figures (3)

• Figure 1: MEC-Enabled CIL Federated learning architecture
• Figure 2: Evaluation of Performance Throughout the Incremental Learning Process
• Figure 3: Accuracy vs. Nb. clients & Nb. Iterations